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REMARKS 

">oiiv,diO pn-'Mk! ui. ^ \ ''-is of h^: i. as <icscfjhf.a v\ Vac ■^vco-Kdisn-- VnplKani 
b.iO f..!uJi>srd 4 ou.•'^.■^cti .oiK-cruiii luvd nvw ^.\■.^.lo■i•s. ~ h05C^\ m --Cj'iiwnu'Jil shoe? si;o\\ ini-. 
v!!^^^;^r^ pu>s;ran; .■:] as wvli as a ix>\ aiitkd So tliv l^<ncs 'Ha JiPc ucpiciuur UaN, cutojs Nn -k'v, 

lheo\.;ir:;a .vov ;su^naii> iojf. led ( '!aj=ij~' L W i", Jl 12. 14 2^ ui-da -U 

AppLi a'^= \i.>-c:sos ihsv scivXtiOii, Mtj(.o iiduu ] of ;he .tvuani case «,Iii^:ning a s.d- 
c<)nii-j!Ktu<)/s .1' ihe iiioia'-id and s\ ^itix) ohi sncd m \hc^-.'> pondiPi? -ippl-i.M?K>K 1 he . oi)l-ol lo-Vioi 

applicaijois AoL.iidii'.Lix , iLc dii^cicixws i>tis\fcn t!ic olanns ,ac Uial tlx\ a;c cj<.>JoJ k- 
dslicjo'U ijis'cns As NUfh issjan^-c ^'t a pjlciit on sKl suhu-os n-tattot "f iho nv!aiu oas^ v.ould 
■i-n o\!c!;d Uit n \hc iJaiu!^- \n \hc pcudrjL' v\iso, .o\<A \xo Ihoicfoie, tPc 

"r~e>-1n>n i' !i-iip's--pcj and sLi^ilJ he ittiKned 

h fe^po;v^. -.^ Appluant\ .a^MiiiciH, the c>a!r.;3Kr staled thai 

f hf J i j« timt to I'l mm ! J->K ii-i<). 11-22. .imt 24-27 lunhr tin- iwhi t,*ih 
I r< ,!!«! d'lctj jni )( oJ.vi<.ii<;i!,>-s-i.. pi> tloi(J>!<. {latiriUins;. .i- hems u«iMkma!iK' m < i 

iliSiVn five !ii she sioi^t, Miseicin tiK "^.oiUn*) u bIlt" ii^ !li(> hwhint and 
"i I sitrai i.'')tiSr!.!ier i JcMient" oi Oit method dai«i 1 In >hi> co-jxiiKiiKs; dpiiiutiSi'sn, r- 
siiinor }>at<-HUhS\ iisdistiui { amf ate <Jiitt!((! t.) tiu ).<iini !ii\«ifiu> ci>Bwpi, Sin 
s«S>3<i! f!»<istvr<.i tin »,im-x>er (iiiifd t- hilU il!t,tl<»se4i "u aii'i (.»>fttd tin 

\pp'.K-,;ia iLsa;.'joe-> ^^■eh ib.is jiujKsis CUmM iho prj-.i.tj{ .ippl\'a!K'{; j.vsk^s ; - a 
ti'i.Su;! caisie? -^siofx' h;c K\;tiiiv'-> o5 aiM.-aif ol< ini 1 aie "a v't^ir.paie! ^>Mc;;i Cv-iUpj ii 
cr.ur L-a!j!.'.i!K>;j <io\ sco Hn. oniup>HC5 s\v,tetii j\ecuuijij luu'.cs- -o a!;a,>/c ihc ajUsii...ji daia 
i P50v\>ss u> ,s;aio\Nass <uiJ a liitcnng pu>ce^s 



In LOii-re.si, duun i kvikJ every indentadent eiaivii oi" co-pending applicauon '^61 -.s 
(lirccfed U> ihc ovcridl sysieni includuig the TVionj.{or>=, cojiuo! center und ihe galevvay^ reciied 
tiiher a^ posiiive eienients in appavaUiS/ariick chiinis or as ptAsiiive steps earned oia on {ho.^c 
ciejuerHs in •Tieihfxl claivrss. 

The examiner having failed to show ihat the sub-combmatio« would be obvious In vie 
oCtbc con-ibuuiikiii, it h sabi-bfied thai Ihe rejectit.ni is i/uproper and shouid be removed. 

Claim RiiiectioiiA - J5 VSC §102 

The exanuaer rejecu-d Claiins L 9. 18, and 2i under 35 IJ.S.C. i02(e;, as heini;: 
antieipaied by Cheenwaid e{ al. US PUB 2(.H)3/0!499i9 Al, 

Appllcai-rs eiaiui i , a,s pres loa^ly prcseutcd. vsas disiinet ovcv Gix-esrsvald. NeverdKiie 
Appiicarsl has amended die elaiins lo clarify die Habieci. mauer chdnied. 

A,s anjoiuled, claim 1 is dlsuuc! over (jrecinvaid siiiee Grcciiwaki neither describ;.-;,; nor 
siiggesf:- ... a conirel een.ier eoniprisir:g a eoirjniuvncatsoj-s device, coupled {o a physically 
separate network from ihe network that the data center k coupled to, to receive statistical data 
collected from network traffic flows collected by a plurality of monitors . . . ihe monitors sendk 
the siatisiical data . . , over ihe physically separate network . . . the computer system executing , 
a process \o ar.alyze the staibuieal data ... a pr<.K-ess lo idervrify gateways on the nionitorrng 
TKnwojk thai are sources o!" nudicious naffic de>^(.ioed for the data center afui a filterujg proee>;s 
ehminate 5]>e nsalic.ioiis tralTie iVom entering iljc victim data center, 

Tlie exantnser contends ti;at Greenvvald teai.:hes . . . "a conivniinicat ion device Spar. ^Wl, 
receiver fauli diagnosis engbte.) to receive data from 'd phrrafuy of jftoftdors (plurality of lauh 
Cfigiues on fig. 3 eiemciH 150) dispersed tbrongbi the Ttetwosk ... Appbcaru disagrees. 'Ine 
iauh cugh ie;;. as dtscrilx-d by Greero-vald, are not the recited nuntilors aixi I hiss Ci reenwald doc 
not teach a comnuimcation device that receives data from a plurality of monitors, as claitmed. 

Rather. C?reeri\vald leaches that '1"-anh diagriosis enghre 101 provides a nencrie 
mechaidsm for tauh. handlers 150 to regi^rer for changes in ihc proec>sir=g siate of faidts of a 
given fault type, f-anlt diagne.sis engine 101 may employ ajiy niechartisn:; to si-.iccify 
registrations. " Cireenwaid also describes !.he fault handlers iSt.) as: ",fVu.Ut liandiers 1 50 are 
.regisiered for a pursicular (ault type and slate and, as pan of die registration proces.-;, each iauit 
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handler 150 has ai^ imcger prioriiy value " Thererotc, the .so caHcd faiili himdiCiN anil the fauii 
diiigviosii^ erigiiio ure noi colicolirjg stausiicai ij •format ioii on network traffic nor a-ialy^^^ittg thai 
mionnaiion m the coniml center. While, Greenwaki also mentions thai; ''Fault handlers 150 may 
e.:<.i:>t -nienu-il io she syslcm. or reside extcrsuiUy in a scpa.iate process,", it ls clear tluu Circcawiiid 
j:^ not describitig "to receive .statistical dara collected from network iraffic Hows cf>llecied by u 
piuraiity of 5;;i.,!niiors'" and Ijence Greenwaki h nor describiiig the claimed "a a/niausnication 
aeviec, coupled to a ?;ec<.>rul sepaj'atc iicLwork, that is physically .separate lYoni the netwcsrk that 
the data uenicr is coupled. 

The exaniincr also conlesids that (jrecnwald tcachcN: 'Vith the int-nitors scsulisu; data 
coiiected froii? U-e neivvork over a rcduridaiti neiwcrk, wjils die redirndant ;K>tvvork hc;ng a 
physically separate :5etw;.M-k fViim ihc neiwork that tlie piuraluy of sriOi5i?ors collect data fson\ 
i par. i)032, 0025 and fig., (v. in a physically dil'ferent network.) . . .".Applteani also disagrees. 

While the cxarrdvicr relies on Fig. 6 aiid pauigraphs 002.5 and C.!u32 to :si.!pp!Y this 
leachifu;, i!. is apparefit that 10032] lia.s no specific, relevaijt teaching directed i.o this feature and 
Fig. 6 merely snows a grouping of subnets in a network. Whether or not tijesc subnets arc 
viewed a^s diltereat nei\vorks or not. it is clear that to the extern thor^e siii,)TK>t>? rnciiide 
'■nK.-viU!.ors,'" those n;onitors send data collected from the network over those si.ib.ncls and hence 
CTrct-nvvald is noi. describi.ng the claimed "a comrnunieat-on device, coupled to a phy.sically 
sep:.u-ate rsetworl. .troni the sietwoj-R that tlie data ecnicr is coupled so .... 

1 nc exanriuer al.-;<.) contends Unrt Oreettwaki teaches: 

a jKDcess Ihm exccui«s on the computer }.y;;tem to mmlwa the data from Jhe pjumltiy of 
«;o»su>rs lo dcterrviine (wiwyrk iniaic siatisiies ih;S can identii'v raaiscious neiwork iraiSle 
\'. n>-y,,XK ik --^ dounnu ^-> i ciuK fob u isi s , 1. i,), e.,i-fi ^^ 
.;;;!:i:i-..'.:. .f.-e amlyr.fs unJfihcnfi^iprocfii- to idemify auiihious i/vfiic and U> flimimUv 
fhi' miihciinis trajfic fi-iim eaiaring (he yktim il^ihi c:etiii;r ip<n: i>lfHc!i;d fig, 6B- 

t(j siJcOTid dt-'vice uijosi dctmion)." (empfiasis in origmai). 

AppUcani also disagrees. While the CAannTJcr relics on f<ig 6b-c and paragrapin 0(!32 
and 0104 to supply tins teaching. ;i is apparent that j0032i has no specific, relevant teaching 
directed to this feaiure, and Idgs. 6b-c merely show i'ault isolatioii and dcie(;tion ushig a [ring test, 
Whei.hcr or aoi. th^csc aciions can be used to detect atiacks, tt^ose techniqties do not desciibc "a 



si 
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ptovvxs .la.v I } . s{ M -K iU . f . from the plurality of monitors ... a process to identify 
gi5it.'\VLiy.s on the inonitoru)" net work thai arc sources (if .malicious i.raffic ... irnd v. .filterii^g 
prtjccs;,-; to ciinsiruUe the inalicious xraihc iVom entering ihe vioiJii! data center,'" rk-acc. 
Greenwakl neither describes wot svigge.st cJuirn j, 

Claitris 9, 18. and 21 are aliovvabie over Greenwaki for a.iia!ogous reasoris ;■!.^ ii) ciairri I . 
|--or example, ciauri 9 calls receiving ... .siafistical da!.;i from a piiiraliiy of nionuors.,. vvith the 
numitctis seriding Utc .Ntailsiicai daia collected from the network over a .«ccond, dUTerent network, 
thai m a phyvsically separate network from the network that the piuraliiy of moidLors collect data 
from, 

Chim 9 also requires analyzing ... the statistical data from the plurality of monitors to 
deif!-!.inne rictsvi..>ik uaffic sta?i.«ics that Cisn icicritdy sources of uKdicious netsvi^rk traffic and 
deicrjnining . . a .niterijig process to install on devices i.n rlie neuvork that the trionis.ors collect 
data tVean so irJribi? tlic n-alicious traffic IVosV) entering the victirn uaia center. 

Claims 18 and 21 each include similar features as discussed atid are allowable for 
analogous reasons. 

I .tcv,.-iMc - ct-ted C ..nrs i 3 D-t\ ^> 12 '3, U\ijJ:I inJo! ? SO ' ^'U 
Ik un-^ h. ...n,. .^o: Mc^^vse. iu ^ icu ^^i ^ a^ ,id Ji a J 6 Tj; 
llv'cx. ^ u CM^ ..it ,d)at 

MisMSici {i>,kI<i ,i ttniJvSi l f«iu>i itiiiii ( < <Vu!4kf (MHv d<tta ^t(st(« ns«t 

.linns' i. uiiM in Ntt^ ii« i, lnnuist \!ts,nii.r tiii<his ih.n tin O.iU vt^mu 
'u^yml srs (5*i«ork U.tiYu kxSuwnitiu it tin us>!(iim r\ }ut»i(tk ^^ utifit r ,(tiatk 
M<>^^i« i(ai.$(t' <i \tt!(»j .iaU viiKcr, iKX^fisi' %{(ssp)ti iMitKsthaS imt-uiirx-fiis; 
li Is >is!<j i cletitSf")!, iitK> e(.>injMii> tiwf tUns this )^ t^-utitt rp<im, ( <>tiuki{U<i< 
.^s- «ittfj ,<.us!<>iiitiM!<i«ork Mtliia^ t5t, itu (.usjotnej', ([rt>> wk i\ th( vuistB 
(Isiiii i-i'titar. 

\|pn.c''>;o ; e>>^ \s j'fuoo b% \ppi.v.anl je^,o^d t^nN \m j<.kdK 

1 jrscv> < vO! oKomc! lo v-ooid^iKuc Jn-' atime Jti'.tk- a ^ u uan iMta > . cei 

dxn^' to N'es-i^j \ 'bt -iJl t s ; p^^>^,kKl^ vi vhe ai.xic aie a.ed .o sajiitKx att xl ^ Ik 
sa\^u>l liia.'.'i a .o.,.i<\ .etnes ttnr t.<^v>Kiu\t\'- J^vuntu^.; >ii a.'..v.k- Mo o>\c Ih- 
aisalc .ea. nes a^\ > ho-p, t^i.s 'e. lute l'\ stalnv that Cosirie-p.a.i sta> ^is .I'h .o.po'ati^^rs 
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on how to combat threats but do «ot make changes to the corporation's equipment." 
..■•\ccordingly, K-les.^s-icr Sails to leach the feature of the ... '"{he camputer sy.steD-- execuuiig a 
proce:>,s iv! analyze the siaristical data iVoni She plurality oi rai.ini{Oi:-: ... a process to ideritify 
gau-'vvays o?5 the riKvaiioring network that are sources of niaiieieus iraffic desimed for the data 
center, and a filtering process lo eliminate the malicious traffic from entering the victim center." 

riie e.\aii5U-er's contcvition \hui\ "... coordijiating thwarting attacks is taught ivi Mcssnie?-, 
bck:a;.ise .Mcs^sricr teaches that the duta eertier nioniiors lietwork tiaii'ie to determine ii'the 
ciesic.mt---s neisvo.rk. .i.s amia: aitack." does not uicet the elaiin ksrsgiiage and faiks to address Lhi; 
icachi-ii; -n .Mes^nst-r ihal: "Ceunterpajie statlers advi.sc corporations on. how to ccimbat (hreais 
bui do not niake changes to the coipCinrUon-s ctjuipnicnt.'" if ("ounscrpanc sialTs;rs advice 
ct.)rp05ation.-* brit do net n-ake ehianges to ilic equipfnent, C^^urUcrpane cannot inhcrcDtly di.sclose 
a eonifo) eerutr tiuit has a liltetiiig pr<K'e^-s to ideutity malicious traiiic and ciindnate the 
raaheious traOic 

liie e.\a:n:ner a'is(! contends thai: .Messnicr Lcaeiies a hardesuxi red\.ind.arit net\vork 
beeaissc die data eodccied is sent in encrypted form to th.e central corsiroi center i:Kc lines 23- 
28.,!. Applieasn. con^cnd.^ ihui this diseu.s.sioP! still docs not nieei the claim lauguagf; as recued in 
claim I of *'a eonMnunication device, coupled lo a physically separate network from die network 
that the data center coupled." 

The sriere tact that Messvner teaches that "tnonUors are on the cnslonicrs rietwork s' i 2- 
26);' does jioi meet ~\'he physically separate nctwotid" limitation because .Messsner faiis lo sliow 
that die data collected on those neisvorks is transferred to the central ccsntri.il center in (.■aiitomia 
or Virginia withoiit using part oi the network thai is being rnorhto.red. 

Tlie exasnirter ackn(>w1edges thai Messmer is silent on, fiitering proces.s to identify 
malicious iraffic and to eliminate the malicious traffic from entering the victim data cetrter. The 
c.'<.;;rnine!- relics on Yavatkai' ei ah hi particular the cxannner eoniends that Yavatkar et al. 
discloses: 

,if!.ij\ /if!^' ' rjiJic w« .1 (>i k }» montfoj i»s m s-i^tu-k traifk st hvn .i p.ir siLis' 
!U'e,u.r^ nU,kk js lii'iuk^i }n yaiht-nw; lotoritunon Ainmt Hk W.ifi'u ots Uk 
ssi>i«!nk ti>v«t{j>h u'litimi.aii ii(.t«'irk 's<f., hj;. 2). f>> UiiiKhj!Si> an <i<>ets! and Umhw 

|it- ,j oi Jj.ttSit. SraKciMiis; flu' i<iuniiu(t (ink Ui tin m<k .teryss thi i)!iK 
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s>y hafiiiifi. cksiiif: ihe fjath. siiuiiiing doivti, ami/or isistytiiiij; af>[>f (.>f)riat*: filter ois 
Eh<: ijioreitor ^jaievvav isci; col- 13 Jii!i.« 54-c<tL 14 lines ..Ut. li \< <mUi fiavt- bt-t'ii (Jbiioii;-; 
U^ "Hi; Ofxlhian skiU in tiw isrt at flu? tinii; of the (nvi:iitio!i to iiidMtii.- Vavatkar 
ul'i sliiorsfii> prtnirsv aJuS ciiiMinjite the ni;iJis.so«.s frsffHc i'rosn (;iiti.-ri!i!; ihi) vk.iim 

ihi- ykmn'a >>i)rnps)ti:r. Om would ha-> f Ikhmi mi(iivak-tt to iiv bcciJii.ii! it \<,utttd 
furiiu!- th(: viciiin's syKK-H! frisni nisiicioii'v attack that ss ^>ver tin- 



Yavaikar c\ al. fail Jo disclose or suggesi the clauned system wheihicr taken alone or in 
coinbinaiion with Messnier. "j'uvuikar in particular faib lo ck;scribe either a pi'oce^- t»> lutrtj' ^ 
gateways on the njojnioring network thai arc sources of malicious traffic destined {<m .fJ. 
center vv a filtering pjoccss lo eliminate the malicious traffic from entering the vit,<u d \ 

center; ' as claimed. 

The examiner pieces element «{ from Yavalkar ct al. thai exist in unrelated i l ,k\msl-ss 
Viivatkar U> anicacx filicring for die ciaimed sysieni. Ilic teachings ai On. 1 liu. -^4 tu ^v^! 14 
line 32 add vioddng io Mcsssner ihm what Messmer ieachcs alone. 

As vvith Messnun-,. bu- unlike Applicanf s claim 1, Vavt'.ikar discloses dua \ no ^vosk 
adrnnnstraior using a sPiiflcr may detenuinc whicli physical iink {o\ nrahiple lijiks v> <ic i v 
receiving aiUsck •rail'ic is llic source oi such traffic. (Jeitaii) inodi.nev: resident on nud - \), 
peribrrn sim-lar iisnciicijis under ihe direclion oi a ceniral console. Whh sLkd- innr!K<j*K'>i <i 
siclwork iuhninisiraior may n■iO^■e from ufide lo iiode, tracing du: pati^ oi {he lios!d> tk^^ -\^s 
from the viciin- trjc source, or to die gaievvay allowijig snch traffic {o eafer die f c(u<mI <.s j 
nicdiod of des.erminiug the source (if messages is slow." fiowcvev, the des-tce disvlwsod 
Vavatkar i~ n\H described as pcrlormmg any of the ciahned i!mcu.o;is of claim 1 , 

In parucidar for 'Milteriug" examiner relies; "traversing the idenUiicd link u- ii i. > od.. 
across iiie link by haiUiig. (..-iosisig the path. shutu.ng dowr;. aiul/or insiaiiing appr(> r is... o i 
ihe moni?(n' ga!e\say i ^ee col, 13 Imcs .54-co!. 14 lines 3,1'~ While Ya\ aikai doe-; noa..<^! u n < i 
an method, at Col 13, .aaniely: 



Hosvevt-r. iisisig *;t«Teni. jHi:!h(!ds !o idciitifv tht- j^alcway y.bkh is, in ti&it, ihe 
fisijsjic of ;it!a(.k iraiilt: to t!)e i)et« ot U caii ^)^^ <iif'ri(.(jit anci tiiiit e<iiis»mjf>«. .\ 
jittwfviSi udiKiiitisiraiof ts^inga .■jralTcr (ijay (1<^K-nTut»e wkurh pliy.sicai Mnk 
nmUiph- links! on a (in ice ri-uivitij; uU^R'k UniTiv is slic sotircv otsurh traffic- 
<:i.>jt!!S!i «)(xSiiii;s ri.'Kici<:«t on intdLS Kia.v {M-'i-iorm ;.;(n(i!ar- rarittiom (jixJer i\K 
ciirectioj! ota i'tritrai coa.soit- Wi-h sucli )nf(!!njatio!5 A KfC.vork luinjinistraJor H!sy 
jtKfK- trooj (Kuk to «'kS'.:, triicitjg iha paih of tiic iiostiit; jiii:S'>agt'.s fnuii i\w ■^kihw to 



^ jl\ I .v.\i..i(.^ .1"- u \n 0 i\ > Oil bo vi'.ivii; v>t a Mrf(t.i .Lwc .'jgjiri:^ H s-^ < 
in venison . 

record, and that claim 6 is allowable at least for the reasons discussed in the base claim. 

("IriiLns 9, 12- 13, 1S-iy, 2i arc patentable .(or anaiogoii.s ressojis as those g;ven k^r (.lai-ns 
1,3 and 5. 

The exairruier also rojceied claims 7-S, 14-16, and 24-15 under 35 U.S.C. i 03(a) as be.'in« 
UDputeniablc i.vxaa- ?vh:vsii-cr iii view of Yavaikar ci ai, IJSPN 6/735,702 Bl afid funJier isi view of 
Hilletaf. 

These claires add die iimualion thai the ariulvMs pj;ocess ckissilles ati.ad:>: and detennines 
a response based or> the class of aaack {Ciainis ?, 14, 24} or classes oi aiSack devK.ned as iow- 
grade with spoofing, low-grade without spoofing and high-grade whether spoofing or non- 
spiii.jfirig iCdahvis 8. 15, 25). Tiiere is nc-tbing in Mcssrncr or Yavatkar that suggests aii anaiysis 
process that determines a response based on the class of aitack, whieh the e;<aTnii!Cj; 
aeknowiedges. rb,e exarraner reiics on .Mill for Lhk^ teaching. However, 1-iiil d',.>es not solve airy 
o!" dic dcficieiKdes ai the ecsnjhirjarion cd' Messnjer and Yavatkar as no!.ed above as-C Mill fnrUicr 
rehues tt) aitiick siy.rauiires not to the feaiares i..!f the base ckrrn.U'v. Tiicrefore, these ckihris a.re 
allowable at least lor the reasoiis discussed in the base claims. 

It is believed that all the rejecttons and/or objections raised by the examiner have been 
addressed. Canceled claims, if any, have been canceled without prejudice or disclaimer. 

Any cireurnstanee in which the applicant has (u) addressed eertalTi eoniniera.;s of the 
e,xa.i-!nner does not mean dia! die applicani concedes otlier eoninients of die e.xandner, ibi inaue 
arinanesii.s for the pateniabiliiY of some claims does not mean that there a.re noi other i;(!i.;d 
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^ iso 1. " , ^ 5h t <• 1 1) V c .i^- and i^thcr d^mi>- or 5^0 s yijicridod ..);■ canceled i-'Liin; 
claim or other chuim. 

in wc\\ vu'thc ioiv-voiug svLnatks, applicant lo.sncvituiix subiriK '-hii 'he .ifv>li< ainm -s in 
L-Oi"!vcii.icnCij. 

Please charge she S60 f^etititm fo: b\ie;i?5i>n ofTimc ice K"! l,'>cposit \ca>uns Nn 
1 (.):■!}. Please apply any oihcr charges or >.rcJiis kf deposit account Q<> \ 050. 
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